CVE-2026-64570 Linux CVE debrief

Who should care

Linux kernel developers and users, mac80211 subsystem users, security teams, and operators managing Linux-based infrastructure should review and apply patches or mitigations. Vulnerability management and platform security teams should prioritize patching and monitor for potential exploits. Security teams should review system logs and monitor for suspicious activity. Operators should ensure that their Linux kernel deployments are updated with the latest security patches. Compensating controls, such as monitoring and detection, should be reviewed and updated as necessary. Asset inventory and rollback/change windows should also be considered. Source tracking and exposure review are recommended to ensure that all affected systems are identified and remediated. This vulnerability has a medium defensive priority, and defenders should take proactive steps to mitigate potential risks. Additional recommended actions include reviewing compensating controls, monitoring for potential exploits, and tracking exceptions and retesting remediated assets.

Technical summary

The vulnerability occurs in the ieee80211_set_fils_discovery() function, where it calls kfree_rcu() on the old template before allocating a replacement. If the allocation fails, it returns -ENOMEM while the link->u.ap.fils_discovery still points to the object already queued for freeing. This can cause a double-free error when the RCU sheaf is processed in softirq. Affected products include Linux kernel deployments using the mac80211 subsystem.

Defensive priority

Medium

Recommended defensive actions

• Apply the patch to update the ieee80211_set_fils_discovery() function
• Review the Linux kernel's mac80211 subsystem for similar issues
• Monitor for potential exploits of this vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was resolved in the Linux kernel. The bug was caught by KASAN when the RCU sheaf was processed in softirq. The problematic code was in the ieee80211_set_fils_discovery() function. Evidence limits suggest that further review of similar issues in the mac80211 subsystem is warranted. Defenders should verify patch application and review system logs for potential exploitation attempts.

Official resources